jeremy/hobbs-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: syn2mas dry-run results and count reconciliation

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
jeremy
2026-08-20 15:09:07 -05:00
parent af2b560686
commit f9a024ce10
1 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/plans/mas-auth-inventory.md
+29
View File
@@ -39,3 +39,32 @@ ssh glyptic@192.168.86.192 'docker exec synapse-db psql -U synapse -d synapse -t
``` ```
Compare against the table above. Device counts may **grow** (new logins) but must not shrink for token-based accounts. Compare against the table above. Device counts may **grow** (new logins) but must not shrink for token-based accounts.
---
## syn2mas dry-run results (2026-08-20 20:07Z)
`syn2mas check`: **"Check completed successfully with no errors or warnings."**
Dry-run migration summary (rolled back automatically):
```
20 users migrated (0 skipped)
0 third-party IDs migrated (0 skipped)
0 upstream links (external IDs) migrated (0 skipped)
53 non-refreshable access tokens migrated (0 skipped)
0 refreshable token pairs migrated (0 skipped)
53 devices migrated (0 skipped)
```
### Reconciliation against the pre-migration baseline
| Metric | Synapse | syn2mas | Explanation |
|---|---|---|---|
| Users | 20 | 20 | exact match |
| Devices | 65 | 53 | 12 of the 65 are **cross-signing key pseudo-devices** (`display_name like '%signing key%'`), not login sessions. Real login devices = 53. Verified by query. Cross-signing keys stay in Synapse's own e2e tables. |
| Access tokens | 54 | 53 | The one token not migrated is **device-less**, and MAS compat sessions are device-scoped. Identified as `syt_Ym9i_…` — `Ym9i` is base64 for **"bob"**, a leftover token from the decommissioned `@bob` agent, attached to `@spirit`. Last validated months ago. |
**Spirit is safe:** its configured `accessToken` (`syt_c3Bpcml0…`, base64 `c3Bpcml0` = "spirit") maps to device `CEBHTAXUAY`, which migrates. Verified by joining the config token against `access_tokens`.
**Conclusion: go.** No account loses a credential it actually uses.